High [CVE-2026-9563] Denial of Service via uncontrolled resource consumption in JSON parsing

In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document.

Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. A remote attacker could exploit this by providing a very large, specially crafted JSON document.

This is an Important denial of service vulnerability in Eclipse Parsson, a JSON processing library. Applications within Red Hat products that parse untrusted or attacker-controlled JSON documents are susceptible to excessive CPU and memory consumption.

This can lead to resource exhaustion and service unavailability due to the parser not enforcing limits on the size or complexity of JSON input. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

Weakness: CWE-770. Affected Red Hat products: Red Hat OpenShift AI 2.25; Red Hat OpenShift Dev Spaces 3.30; OpenShift Serverless; Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; streams for Apache Kafka 2; streams for Apache Kafka 3.